Overview

overview

10

Static

static

aed5c73557...8f.exe

windows7-x64

10

aed5c73557...8f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f

  • Size

    381KB

  • Sample

    230129-mk5v6ach5w

  • MD5

    0957d5d8d21751f2fd1ad2015b19abe0

  • SHA1

    c098ddc18a8a0dade35436f968eb43c1f4c9253c

  • SHA256

    aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f

  • SHA512

    a7cbde567cd869828c757bd32a6571c401782bbdc54b76c1faa9e9b2509187b81dd85a0db641fa182c04edb598be75009ed02e9f0f196942d9662a8b1ed3e0b6

  • SSDEEP

    6144:3rK18vkksg2P4vWigPJJJPJJJGJJA/+aU4Kau:3rMlM2QvgPJJJPJJJGJJpF

Score
10/10
ramnitbankerevasionpersistencespywarestealertrojanworm

Malware Config

Targets

    • Target

      aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f

    • Size

      381KB

    • MD5

      0957d5d8d21751f2fd1ad2015b19abe0

    • SHA1

      c098ddc18a8a0dade35436f968eb43c1f4c9253c

    • SHA256

      aed5c7355746817265352226221264d35bf753a44f273912d42629019b7c4b8f

    • SHA512

      a7cbde567cd869828c757bd32a6571c401782bbdc54b76c1faa9e9b2509187b81dd85a0db641fa182c04edb598be75009ed02e9f0f196942d9662a8b1ed3e0b6

    • SSDEEP

      6144:3rK18vkksg2P4vWigPJJJPJJJGJJA/+aU4Kau:3rMlM2QvgPJJJPJJJGJJpF

    Score
    10/10
    ramnitbankerevasionpersistencespywarestealertrojanworm

    • Modifies WinLogon for persistence

      persistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • UAC bypass

      evasiontrojan

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Modify Registry

4
T1112

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks